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F-8C ADAPTIVE FLIGHT CONTROL EXTENSIONS 
Gunter Stein and Gary L* Hartmann 
Honeywell, Inc. , Minneapolis, MN 

SECTION 1 

PROGRAM OVERVIEW 

NASA is conducting a research program in digital fly-by- wire technology 
using a modified F-8C aircraft. To support these efforts, Honeywell initiated 
a design program in 1974 to provide digital adaptive control laws suitable for 
flight test. As part of the ground rules, measurements were restricted to rate 
gyros, accelerometers and servo position. Adjustment of the control laws is 
based on this information. Aircraft like the F-8, whose performance require- 
ments can be satisfied with air-data-scheduled control laws, benefit most by 
eliminating air data gain scheduling. This will be particularly valuable for 
future aircraft requiring flight- critical gain adjustment. The control laws 
were constrained to be compatible with the existing airframe without structural 
modification. Hence, they use only existing elevator, rudder, and ailerons as 
control effectors, each powered by existing actuators. 

The design program recommended an adaptive concept which combines 
gain-scheduled control laws with explicit maximum likelihood identification to 
provide the scheduling variables. This approach was selected from a compari- 
son of three candidate concepts : 

• Implicit gain adjustment based on self-excited limit cycles 

• Gain adjustment based on explicit identification using a Liapunov 
model tracker 

• Gain adjustment based on explicit identification with Maximum 
Likelihood Estimation (MLE) 


The MLE Baseline 


An overall functional diagram of the recommended design is shown in 
Figure 1. The control laws consist of a quadratic -optimal C* model-followi 
system in the pitch axis and a first-order roll model- following system in tht 
lateral- directional axes. High frequency roll-off compensation and integral 
action required for trim were incorporated directly into the optimal design 
formulation. The resulting feedback and feedforward gains were simplified 
and approximated as simple functions of estimated surface effectiveness by 
the adaptive algorithm. 



Surface effectiveness estimates are obtained from an explicit pitch-axis 
parameter identifier based on standard MLE theory. To avoid on-board 
iterative calculations, the identifier uses a parallel channel implementation. 
Several Kalman filter channels operate at fixed locations in parameter spact 
Likelihood functions are computed for each. Sensitivity equations are then 
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solved only for the maximum likelihood channel and used to interpolate from 
there to the correct parameter value. Theoretical id ent if lability results 
were used to determine the number of parameters that could be identified 
with small test inputs. This accuracy analysis also provided insight into 
the number and location of the filter channels. 

Five parallel channels suffice to handle the F-8C aircraft over its entire 
operational flight envelope. They estimate three parameters — surface 
effectiveness pitching moment due to angle- of- attack (M^), and air- 

speed (V). Estimation accuracy depends strongly on the signal levels in the 
control loop. For the small test signals tolerable in operational situations, 
errors of 10-2 0 percent in and 2 0-30 percent in and V are typical in 
six-degree-of-freedom simulation runs. Theoretical accuracy analyses 
confirm these error levels. The gain adjustment in the pitch and lateral 
control laws is a function of estimated only. However, the MLE design 
was selected in large part for its potential to identify additional parameters 
which may be needed for scheduling in other applications (ref. 1). 


Design Extensions 

The design program was extended in 1975 to further develop the MLE 
concept. Three specific areas of study were selected: 

• Improvement of the baseline pitch- axis identifier.- This 
research was directed toward improving the performance 
of the MLE algorithm by incorporating attitude data, esti- 
mating gust statistics for setting filter gains, and improving 
parameter tracking during changing flight conditions, 

• Design of a lateral MLE algorithm. - The purpose of this 
algorithm was to improve true air speed and angle-of- 
attack estimates during lateral maneuvers. These 
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estimates could then be used as scheduling parameters 
in an inertially coordinated lateral CAS. 

• Analytical redundancy.- The purpose of this task was to 
examine relationships between the pitch axis sensors 
inherent in the MLE design and to exploit them for sensor 
failure detection. Success of such techniques could 
reduce the number of redundant sensors required in 
flight control implementations. 


Conclusions of the Extension Study 

Research and design efforts performed under the extended program are 
documented in this report. They lead to the following major conclusions : 

1) The pitch- axis study indicates that on-line estimation of 
gust statistics works well and will reduce test signal 
requirem exits and/or enhance accuracy. However, no 
significant improvement in accuracy is provided by 
incorporating attitude data. By restructuring the para- 
meter interpolation as another Kalman filter, significant 
improvements in tracking time-varying parameters can 
also be achieved, 

2) The lateral study shows that inertially coordinated 
lateral control systems can be implemented without air 
data measurements. A lateral identifier was designed 
to improve the baseline angle-of- attack and airspeed 
estimates. These were used to schedule an inertially 
coordinated CAS and show good damping and turn 
coordination. The resulting adaptive structure could 
potentially be simplified to a single extended Kalman filter. 
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3) Preliminary results on analytical redundancy indicate 
promising potential for sensor reduction in redundant 
systems. Three candidate analytical redundancy pro- 
cedures were developed which exploit existing compu - 
tations in the baseline identifier structure to detect and 
isolate gyro and accelerometer failures. Limited 
simulation evaluations of these procedures show promising 
performance of at least one candidate. Further evaluations 
are required to solidly establish false alarm and missed 
alarm characteristics. 


Document Organization 


This document is subdivided into six sections. This section is an 
overview of the extensions to the baseline F-8 Adaptive program. Section 2 
presents a list of symbols used throughout the report. Section 3 presents 
the results of the modifications to the baseline pitch identifier. Section 4 
presents the MLE lateral adaptive design. Section 5 presents the results of 
the analytical redundancy study. Section 6 presents conclusions and recom- 
mendations. Section 7 contains a list of references. 

For additional details of the baseline in F-8C Adaptive Study, the reader 
is referred to the earlier report prepared -under this contract (ref. 1). 
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SECTION 2 
SYMBOLS 


Operators 
Arg {min f(x)} 

X 

E(. ) 


exp(* ) 
ln(- ) 
in det(' ) 
p(x/y) 


s 


z 



A(.) 
V(* ) 


(•) 


1^1 

IMIm 


Superscripts 


< ) 
n 
()< 
( )“ 


- minimizing argument of function f(* ) 

- mathematical expectation 

- exponential 

~ natural logarithm 

- natural log of determinant 

- conditional probability distribution of x given y 

- Laplace operator 
“ delay operator 

- time derivative 

- increment 

- gradient vector with respect to parameter 
vector Q 

- second partial derivative matrix with respect 
to parameters ^ 

- p-th component of v(' ) 

- summation 

- absolute value 

T 

- quadratic form x Mx 


- estimated value 

- one-step predicted value 

- value for parallel channel i 

- nominal value 
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SYMBOLS (Continued) 


Subscripts 

< >m 

- 

measured value 


- 

value at time t^ 

< >L 

- 

value for lateral identifier 

( )p 

- 

value for pitch identifier 

< >s 


stability axis 

< >t 

- 

true value 

Upper Case Symbols 

A 

- 

discrete system dynamics matrix 

B 

- 

(1) discrete system input matrix 

(2) residual covariance matrix 

c* 

- 

response variable + ^co^ 

D 

- 

measurement matrix, y due to u 

^LAT' ^ROLL' ^RSS 

- 

control gains 

H 

- 

measurement matrix 

H. 

1 

- 

hypothesis number i 

I 

- 

identity matrix 

'a' 'g' 'ar 

- 

failure flags for accelerometer, gyro and 
analytic test 

J 

- 

partial likelihood function L ~ 1/2 ZJtzidetB 

K 

- 

Kalman filter gains 

^RP' ^RUM' ^RPM 

- 

rudder control gains 

^Ac 

- 

aileron control gain 

L 

— 

likelihood function 



SYMBOLS (Continued) 


M 


M. 


M 


60 


M 


N 


6t 




Q 


Qi 

s 

T 

% 

V 

Vco 


V^6 


- lateral gust field scale length 

- number of parallel channels 

- pitching moment coefficients due to 
indicated variables 

- trim pitching moment 

“ Mg value for rigid airframe (without 
quasistatic flexibility) 

- true value of M ^ 

6o 

- number of data samples 

- normal and lateral acceleration 

- Kalman filter covariance matrix 

- a priori parameter covariance matrix 

- noise intensities for parameter process model 

- failure rate for element i 

- Kalman filter design statistics 

- transformation matrix 

- sequence of N control inputs 

- air speed 

- crossover velocity in C* response 

- lateral force coefficients due to indicated 
variables 

- sequence of N measurements 

- normal force coefficients due to indicated 
variables 
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SYMBOLS (Continued) 


Lower Case Synabols 



d 


g, go 
h 

i* 

n 

P 

q 

r 

t 

u 

V 

X 

y 

z 

Greek Symbols 
Upper Case 

r 


- parameter vector with components c^ 

- a priori estimate of c 

- true value of c 

- sensor displacement from c. g. (4. 62m) 

- gravity 

- altitude 

- index of the minimum- L channel 

- system order 

- roll rate 

- dynamic pressure 

- (1) yaw rate 

(2) number of measurements 

- time 

- control input vector 

- lateral velocity perturbation 

- lateral gust component 

- state vector 

- measurement vector 

- test statistic in analytic test 

- discrete system noise input matrix 


9 



SYMBOLS (Continued) 


Greek Lower Case 


6e(6), 6^, 6^ 




\ 


a, CT, 


- angle- of- attack 

- gust angle -of- attack 

- angle of sideslip 

- gust angle of sideslip 

- aerodjmamic surface positions 

- stability- axis yaw rate error 

- generic likelihood filter states 

- ij element of r 

- dummy argument for values of parameter 
vector ^ 

- white noise process 

- pitch attitude 

- parameter model state variables 

- exp(-At/T ) 

- Kalman filter residuals 

- white noise process 

- air density 

- standard deviation of variable x 

- time constant 

- roll attitude 

- yaw attitude 

- natural frequency 



SECTION 3 

PITCH IDENTIFIER REFINEMENTS 

This section includes research results on recommended refinements of 
the parallel-channel maximum likelihood identifier developed in ref. 1 . 

It includes a brief summary of the identifier's baseline design and perfor- 
mance characteristic, with emphasis on fundamental performance limita- 
tions which motivate the refinements. Three potential areas of improvement 
are discussed: 

• Adaptation to changing gust level statistics, 

• Incorporation of attitude measurements, and 

• Parameter tracking aids. 

Our investigations showed that the first and third of these areas provide 
substantive performance improvements for the identifier. Hence, design 
modifications are recommended to incorporate these features in the baseline 
system. The second area was found to offer only minor improvements which 
fail to justify design modifications. 


Baseline Identifier Design Summary 

The recommended baseline F-8C identifier, ref. 1 , is illustrated in 

Figure 2. It consists of a parallel-channel structure designed to perform 

on-Une maximum likelihood estimation of three aircraft parameters: 

c^, Cg. These represent elevator surface effectiveness, pitching moment 

due to angle -of-attack, and velocity, respectively. Only pitch axis data 

(q , N„ , 6^) is used for identification. This overall structure is a result 

mti m 

of detailed identifiability analyses for the F-8C and tradeoff studies of several 
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candidate identification algorithms, ref, 1 , Only selected design details are 
presented here which are relevant to the refinement studies. 


Parallel minimization . - The main feature of the F-8C identifier is its 
parallel Kalman filter structure. This structure provides a non-iterative 
way to carry out the function minimizations required by maximum likelihood 
estimation. Recall that the maximum likelihood method provides a solution 
of the following identification problem: 

Given: = A(c) + B(c) + r(c) 

( 1 ) 

= H(c) Xj^ + D(c) k = 0, 1, . . . 


Find : Unknown constant parameters c 


The usual interpretations apply: x’s are states, u's are controls, y's 
are measurements. A, B, r, H, D are matrices (functions of jc), and and 
are discrete white noise processes. As shown in ref. 1 the theoretical 
maximum likelihood solution of this identification problem is 


A 




Argfmax p (Y^|c = Q, U^)} 

ArgCmin - Inp (Y^|c = Q, U^^)] 

. N ^2 

ArgCmin yE [ | ) 1 1 +tndetB(^)]] 


( 2 ) 


where p(«|/3) denotes probability distributions of ca conditioned on )3, and 
denote sequences of N measurements and N control inputs, yj^(C) 

Kalman filter predictions of y^^ given c = Q, and B((^) is the 

error covariance matrix for those predictions. 
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The F-8C identifier approximates equation (2) in the following manner. 
First, it evaluates the function to be minimized [this is the likelihood func- 
tion L(^, k)] at several fixed values, , of the argument . The best of 
these values, is then selected and a single Newton-Raphson step is 

taken from there to the parameter estimate, i. e. , 

The symbols VL and v^L denote first and second partial derivatives of L 

(i^«) 

with respect to Q evaluated at ^ = C • In order to keep calculations as 
simple as possible, the Newton-Raphson step is actually based on approxi- 
mate versions of these derivatives, as summarized below. 

Let (4) 


Then 


A 1 ^ T 

L=^D(vB + ^ndet B) 
k=l k 


VL = S [-Vyj^ + gTr V(b"^)] 

k=l 


N ^ , 

Y) - Vy B V, 
k=l ^ ^ 


(This is justified because E (vv'^) -♦ B as Q c) 


(5) 


( 6 ) 


«i\ tpA 1 A <1 A <Arp 

V^L = S C-V^y, - %V(B'^)v^ + 

k=l 

+|TR[(-2Vy|^V^'^ - VB) V(B"^) + - B) V^(B"^)]} 

- S Vyj^'^ +i TR VB B"^ VB B"^) 

k=l 
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[This is justified because v (zero mean white noise) 
T 

and E(vv ) B as C "" c] 


N 

k=l 



(This assumes VB B 


is small) 


( 7 ) 


2 

Equations (6) aind (7) were used to define VL and v L for purposes of identifier 
design. 


Parameter tracking. - The theoretical MLE solution equation (2) is 

based on the assumption that the vector c is constant over the time interval 
covered by the data sequences and This means that current data re- 

ceives equal weighting with past data in the L, VL and V^L summations of 
equation (5), (6) and (7), and large errors result in the event that c actually 
undergoes changes. Because the latter case is prevalent for aircraft in rapid 
flight transition, the identifier in Figure 2 employs high-pass filters to 
’’forget" old accumulated likelihood data. This heuristic "fix" of the theory 
is actually equivalent to exponential de -weighting of terms in the likelihood 
summations. This can be readily verified by observing that a cascaded 
a c cumulation /high -pass operation has the following analog transfer function: 



» 

s 


1 

s 




s + — 

- 


L T J 


L T -1 


In discrete-time form, this corresponds to 




.N 

k=l 


N-k 

M- 


ASk 


( 8 ) 


(9) 
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where m- = exp (-At/ t), and e denotes a generic output variable of the com- 
bined accumulation/high-pass operation on the input sequence Ae. Letting 
0 be L, VL, and v L with the appropriate substitution results in the follow- 
ing update equations: 





( 10 ) 

^ -1 

VLtv-t = M. VLtvt 1 + (“^yTVxB ’*'Vtvt) 

N N-1 ' ■'N N 

( 11 ) 


( 12 ) 


These equations are used to calculate L, VL, and v L in the baseline identi- 
fier. A high-pass time constant of r = 5 sec was selected as an experimental 
compromise between tracking error and identification accuracy at fixed 
flight conditions (ref. 1 ). ' 

Plant model and parameterization . - Each Kalman filter in the parallel 
identifier structure was designed for a fixed plant model whose coefficients 
are parameterized as functions of c^, and c^. The model is sum- 

marized in Figvire 3. It includes longitudinal short period aircraft states 
(q, a), two Brownian motion states to simulate trim (g/V, M^), and three 
white noise disturbances to approximate gusts and trim changes; 


S O’g ^ 721 ■>'21 = 


w 


$ V" - ■>'32 >'32 - 


dt ^o ~ '^43 '^3 '^43 ^ 6 . . ^ 6 ' 

trim 


Measurements are represented by algebraic sensor output equations for 
pitch rate, normal acceleration and surface position. All are corrupted by 
discrete white noise sequences. 
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M M 0 1 

q a 

1 Z 1 0 

a 

0 0 0 0 

0 0 0 0 


Measurements ; 



k = 0, 1, 2, . . , 

Parameterization ; 

^6 1 o 

M 23 + (, 028 - . 017 Cg) 

^ (, 61 + . 92 Cj) 

V (200 + c,) M. 

Z V 53. Om" 

a oo 

ZgV 7. 7 Mg 

Figure 3. Plant Model for F-8C Identifier 






■k. 
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Coefficient in the model are defined in terms of ^2' ^3 ^^*^ord- 

ing to the parameterization given in Figure 3. Together with specified values 
for the six environmental statistics 


s =" 


(o-. 


w 


CT 


trim 


Nz' 


CTg), 


(13) 


this parameterization completely defines the Kalman filter gains, S), 

and error covariance matrices, S), in the parallel structure. The 

gains alone are actually valid for a broader class of statistics, namely the 
specified set in equation (13) with each element multiplied by an arbitrary 
common scale factor cr ^ 0; i. e. , 


K(C, aS) = K(C, S). (14) 

The matrices B for the same class of statistics are given by 

B(c, ctS) = a^B (Z. S), (15) 

This means that the likelihood function accumulations in equations (10), 
(11), and (12) change as ct changes but the parallel filters themselves do not. 
The F-8C identifier takes advantage of these relationships by using nominal 
values for the design statistics, S = but allowing a common scale factor 
to vary. The latter is estimated on-board and used to scale the likelihood 
functions accumulated in equation (10). 

This process of "adapting to proportional noise statistics" prevents per- 
formance deteriorations due to changing values of the scale factor. The 
following nominal design statistics were used for S: 

S° = (6.0, .017, . 001, . 0026, .644, .0008) (16) 
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Since these numbers are fixed for all operating conditions (i. e. , with 
and without sensor noise, with and without gusts, with slow or fast trim 
changes, etc, ), they represent experimental compromises over many simu- 
lation runs. As seen later in the performance summaries, further per- 
formance benefit can be gained by adaptively adjusting the relative values of 
these statistics as well as their common scale factor. 

Channel locations . - As indicated in Figure 2, a total of five parallel 
channels suffice to handle F-8C parameter identification over the entire 
flight envelope. Their locations in parameter-space are tabulated below and 
illustrated on the plane in Figure 4. The most significant feature 

of these locations is their logarithmic distribution along the coordinate 

axis. Each channel ’’covers" a fixed percentage range (±50 percent about its 
nominal value). This distribution is motiviated by identification accuracy 
studies which indicate that theoretical identification errors are directly pro- 
portional to the true values (ref. 1 ). 


Channel 

location 

Subsonic range 

Supersonic 

range 

1 

2 

3 

4 

5 


’^ao‘ 


-2.34 

-5. 27 

-11. 9 

-26.7 

-26.7 

c = 

c„ 


0 

0 

0 

0 

1. 0 


2 








^3 


0 

0 

0 

0 

60. 0 










Baseline Identifier Performance Summary 

The identifier's performance was evaluated on NASA Langley's nonlinear 
six-degree-of-freedom F-8C simulator (ref. 3 ) against four ’’measures of 
goodness’’: 
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^urfsiQt 




^ign 


P.j 




-ations 


• Identification accuracy at fixed flight conditions 

• Convergence characteristics 

• Parameter tracking during standard flight transitions 

• Response to major maneuvers and configuration changes 

Results show good performance throughout the flight envelope. Identifi- 
cation errors are consistently below 10-30 percent which is mof'e than ade- 
quate to schedule the pitch and (reduced-measurement) lateral control laws. 
Accuracy deteriorates somewhat during rapid flight transitions but remains 
satisfactory for gain scheduling. Convergence from incorrect parameter 
initialization is smooth. and rapid, taking approximately one second to reach 
80 percent of final estimated parameter values. There are also no major 
difficulties with large maneuver (various rolls, high-g pullups, step gusts, 
etc, ) and configuration changes (speed brake deployment, gear and wing 
transitions, and c. g, motion). 

Like all realistic designs, however, there are design compromises, 
operational issues, and fundamental limitations which constrain the perfor- 
mance achieved. For the baseline F-8C identifier, these constraining items 
include : 


• Accuracy compromises due to fixed filter design statistics, 

• Test signal requirements, and 

• Tracking errors. 

Accuracy compromises due to fixed filter statistics are illustrated in 
Figure 5. This figure shows simulator traces of a standard accuracy test at 
fixed flight condition FCIO (h = 0. m, Mach 0. 7). The controlled aircraft was 
"flown" for 30 seconds under quiescent conditions (sensor noise plus test 
signal only). This is followed by a doublet command, then a 30 -second 
period of turbulence (2 m/sec rms)i another C^'-doublet, and finally 
quiescence again. 
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A. AIRCRAFT VARIABLES 


Figure 5, Standard Accuracy Test Traces at FCIO 






This standard test sequence matches assumed filter design statistics for 
the central turbulence time segment only. Errors which result when the 

A 

assumptions are violated are clearly evident on the q error trace 

A 

= (q - ^/q . 

Test signal levels required for the simulator evaluations in (ref, 1 ) are 
tabulated below: 

Rms g’s due to 

FC h(m) Mach test signals 


5 

6090. 

0.4 

0. 01 

1 

6090. 

0. 67 

0. 025 

8 

12180. 

1.2 

o 

o 

10 

0, 

0. 7 

0. 04 


While these numbers cannot be used directly to predict aircraft require- 
ments, they are high enough at FCIO to suggest that test signals may become 
an important issue in flight. Test signal requirements interact strongly with 
identification accuracy and with design compromises which reduce accuracy. 
The errors due to fixed statistics in Figure 5, for example, can be com- 
pletely eliminated with sufficiently large pilot commands or test input levels. 
Conversely, command and/or test signal levels can be reduced with inherently 
more accurate identifier designs. 

Tracking error limitations are illustrated by the simulator traces shown 
in Figure 6. These recordings correspond to a standard max-power acceler- 
ation maneuver starting at PCS, They show estimation errors in excess of 
30 percent on the Aq trace as the maneuver is executed. Errors as high as 
50-70 percent have been observed during more dramatic flight transitions and 
configuration changes. Fundamentally, such "tracking errors" are due to 
incompat abilities between fixed -parameter MLE theory and actual aircraft 
parameter behavior. Even augmented with the heuristic high-pass filters in 
Figure 2, the theory offers only limited tracking performance. 
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TABLE 1. - THEORETICAL GUST LEVEL ESTIMATION ACCURACY 
Conditions 

FCl - 6090m, Mach . 67 

Data Length - 10 sec 

Test Signal - .015 g's square wave 

Sensor Noise - gyro 0. 15 deg/sec rms 
accel 0. 02 g's rms 


Accuracy (lower bound) 


ACTUAL 

a 

wo 

Percent error, a^/[c| 

m/ sec 

“60 

M 

a 

V 

(T 

wo 

0.3 


7.8 

13 

15 

30 

1.0 


5. 0 

12 

15 

18 

2. 0 


3. 1 



10 

14 

16 


Gust level estimation algorithms . - In the face of this limited accuracy 
potential, it was decided that continuous gust level estimation algorithms 
(and continuous readjustment of filter gains) would prove unjustified. As an 
alternative, a much simpler discrete algorithm was adopted which only dis- 
criminates between two levels of gust intensity — high and low — without 

attempting to estimate a explicitly. The discrimination is done with a 

w 

straightforward comparison of likelihood functions. Suppose we designate 
the two gust levels as 


a 

w 

!• 

low 

a 

w 

1 . 

high 


I 

I 


( 20 ) 
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and assume that qt^ = ^ is currently true. Then maximum likelihood theory 
assures the following inequality for N siofficiently large: 


UQ’, N) 


£' = <5^. -t) 


< N) 


C' = •£.) 


( 21 ) 


It is reasonable to assume that this inequality will also hold if ^ is not 
precisely equal to c^ and if is not precisely equal to -t. This has been 
verified with experimental calculation of sample likelihood functions. The 
inequality can then be used as a discriminant function between two effective 
gust levels, i, e. , 


High level if L 


> L 


C' = -o 


C' = (C(i*), 


Low level if L 


< L 


£' = t) 


£' = 1 ) 


( 22 ) 


Identifier modification . - These discrete discrimination equations are 

appealing because they can be readily incorporated in the baseline identifier. 

(i'") 

All that is needed is a sixth parallel channel located at C = C parameter 

space but operating with the opposite gust level, i. e. , with <j ~ t when the 

rest of the identifier is using crw “ -t vice versa. The difference between 

likelihood functions L^^^ and can then be monitored and the identifier 

switched from L to t (or vice-versa) whenever L^ ^ falls (sufficiently) below 
(i^) 

L , The fact that only two gust levels are utilized makes switching particu- 
larly easy. Two sets of filter gains (and gain sensitivities) corresponding to 
cr = t can be stored in memory for each parameter value and brought 

W ,g» 

on-line in accordance with the L' ' - L'^ ' comparison. 
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A block diagram of the baseline identifier with these modifications is 
shown in Figure 7. 

Performance of the modified identifier , - The baseline identifier was 
modified as illustrated in Figure 7, and evaluated on the F-8C simulator at 
NASA Langley Research Center, A flow diagram of the new implementation 
is given in Appendix A, Its high and low gust statistics were chosen as 

= 1, 5 m/sec and .t = 0. 3 m/sec, respectively. Sizeable hysteresis levels 

(6) (pi') 

were included on the L - L decision logic in order to prevent chattering, 
and the original cr estimate (common scale factor) was tightly constrained to 
prevent incorrect gust level decisions during periods of large pilot activity. 
These details are documented in Appendix A. 

Evaluation emphasis was placed on identification accuracy at fixed flight 
conditions, test signal requirements, and functional characteristics of the 
gust level decision logic. The principal results are shown in Figures 8 - 12. 
These are standard accuracy tests, one each at FCl, FC5, and FC8, and two 
at FCIO ' (h = 914 m, M = 0. 8). These tests consist of the same maneuver 
sequence discussed earlier ~ 30 seconds of quiescence, a doublet, 30 
seconds of turbulence, another doublet, and quiescence again - all flown 
with sensor noise and test signals. The traces show uniformly good per- 
formance of the gust level decision logic (the channel flag trace) and improved 
accuracy over the baseline identifier at FCIO ' (compare the Aq traces in 
Figure 5 and 12). The modified identifier also exhibits lower test signal re- 
quirements on the simulator. This is evident in Figure 13 which was run 
with 0. 25 X nominal test signals and shows no noticeable accuracy deteriora- 
tion over Figure 12. 

By comparing Figures 11 and 12 with 8-11, it is apparent that the modi- 
fied identifier still exhibits some residual sensiti^dty to gust levels (=- 20 per- 
cent in Aq) in high dynamic pressure flight. We conjecture that this remain- 
ing error is due to inaccuracies in the long Newton-Raphson extrapolation 
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which must be made from the min-L channel, Channel 4 located at = -26, 7, 
to the true parameter value at FCIO Figure 4 confirms that this 

is a significant parameter separation. In theory, of course, the Newton- 
Raphson step will be accurate only if the likelihood function L( Q, N) is quadratic 
in This is known to be untrue from experimental plots of the function 
(ref. .1 ) and, hence, some extrapolation error must be expected. The con- 
jecture has been further confirmed by locating Channel 4 at ~ “40 
temporarily. This virtually eliminates the remaining gust sensitivity in 
Figures 12 and 13. 


Incorporation of Attitude Data 

The second topic which was investigated for potential accuracy improve- 
ments is the use of pitch attitude measurements in the identifier. These 
measurements were explicitly ruled out for the baseline design because the 
test aircraft is not equipped with an all-attitude platform. Successful all- 
attitude operation is a groundrule for the overall adaptive system. This 
groundrule is relaxed here for the specific purpose of investigating accuracy 
improvements offered by the use of attitude data. 

As always, the investigation began with evaluations of the theoretical 
identification accuracy achievable with and without pitch attitude measure- 
ments. It did not proceed further because these e;valuations showed that atti- 
tude data has no significant impact on accuracy. Representative results which 
illustrate this conclusion are given in Table 2. This table compares lower 
bounds on identification accuracy for six pitch dynamic parameters including 
the three parameters Cg, c^ recognized by the baseline identifier and 

three other small perturbation parahieters'^^, c^^ Cg Which were neglected 
due to poor identifiability (ref. 1 ). The test condition is FCl with standard 
test signals, sensor noise and gust levels. The first column in the table 
represents initial uncertainties (RMS) of the indicated parameters, the second 
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TABLE 2. - THEORETICAL IDENTIFICATION ACCURACY 
WITH AND WITHOUT ATTITUDE DATA 

Conditions 

PCI - 6090 m, Mach . 67 

Data Length - 10 sec 

Test Signal - .015 g^s square wave 

Sensor Noise - Gyro 0. 15 deg/sec rms 

Acceleration 0. 02 g's rms 
Attitude 0. 25 deg rms 

Gust Level - 2 m/sec 


Accuracy (Lower Bound) 


Parameter 

A-priori standard 
deviation 

Standard deviation 
without Q 
measurement 

Standard deviation 
with Q 

measurement 

Cj (M^) 

.065 

. 0552 

. 0550 


. 135 

. 0394 

, 0394 

Cg (V) 

31. 5 

26. 3 

26. 3 


5. 0 

4. 38 

4. 38 

**50 

15. 0 

. 408 

.404 

Cg <^5 V) 

.075 

. 0750 

— 

. 0750 
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represents uncertainties after processing 10 seconds of pitch rate and normal 
acceleration measurements, and the third represents uncertainties after 
processing 10 seconds of rate, acceleration and pitch attitude measurements. 
As in (ref. 1 ), these before -and -after comparisons show that only c^ 

and to some extent, Cg can be identified. More importantly, they also show 
that attitude measurements offer very small accuracy improvements - no 
more than one percent at best. Such improvements provide insufficient 
justification for the added complexity required to incorporate pitch measure- 
ments in the identifier. 


Tracking Aids 

The third topic investigated for identifier improvements was the "track- 
ing error" issue. As discussed earlier, tracking errors are inherent in the 
constant -parameter MLE theory, and the heuristic high-pass filters of the 
baseline identifier alleviate them only partially. Initial objectives of the 
investigation were to improve the heuristic high-pass solution by automatically 
adjusting the high-pass time constants with measured maneuver conditions. 
This quickly proved ineffective because shorter time constants produce 
noisier parameter estimates with only modest reduction of tracking error, . 
Despite their lack of success, however, these early efforts contributed in- 
creased understanding of the tracking error phenomenon and led eventually to 
identifier design modifications with much improved tracking capability. A 
major discovery of the early studies was that tracking errors are caused not 
only by constant -parameter limitation of the MLE theory (i. e. , lags due to 
likelihood accumulation) but also by uncompensated trim transients during 
flight transition. These two error mechanisms are discussed separately 
below. 
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Tracking errors due to trim . - The plant model. Figure 3, is valid in 
the short -period frequency range only, from perhaps 1. 0 to 30 rad /sec. 

This is true despite the presence of the "trim states", g/V and M^. The 
latter are crude representations of steady state (trim) disturbance levels 
which do not properly represent low frequency dynamic behavior such as 
phugoid motion and trim changes during flight transitions. In fact, the trim 
states turn out to be only sUghtly more general than ordinary first order 
washout filters (high-passes) on the measurements q^, and 6^, Hence, 

they have the same limited capability to compensate for unmodeled low fre- 
quency djmamics, 

A comparison of low frequency compensation methods with trim states 
and with washouts is given in Figure 13. In the first method, each channel of 
the identifier is based on four states (q, cy, giv, M^) and accepts data direct- 
ly from the sensors. In the second method, each channel is based on two 
states (q, a) and accepts data through high-pass filters. Dynamically these 
two systems are similar. Method 2 has three small real roots at s = -a 
and one fast second-order root pair for the (closed-loop) Kalman filter. 
Eigenvalue analysis of the Kalman filters in Method 1 shows almost the same 
second-order pair and also two small real roots, with exact locations deter- 
mined by design statistics cr^ and Performance -wise the two systems 

prove equivalent if design statistics are chosen such that the slow roots in 
Method 1 are approximately equal to those of Method 2. 

Both methods fall short of providing adequate low frequency trim com- 
pensation, This is illustrated in Figure 14 which shows traces of individual 
likelihood function for the five baseline channel locations. The traces were 
recorded during the standard flight transition in Figure 6. Method 2 was used 

for trim compensation, with washout frequency cj = a = 2, 0, Since the accelera- 

( 2 ) 

tion maneuver starts at FC5, the minimum likelihood function is L immed- 

( 2 ) 

iately before full power is applied. Ideally, L should remain the best 
channel early in the transition, passing later to then to and finally 
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(5) 

to the supersonic channel L The run shows that something different 
actually happens. Large transients appear early in the transition which 
cause L^^^ to minimize initially and pass control back to L^^\ L^^^, L^^\ 
and L only later in the maneuver. Interpreted in Figure 6, the temporary 
selection of L^^^ over L^^^ indicates that incorrect low values (also 

low q values and negative Aq values) minimize the likelihood function 
temporarily. 

The fact that these transient errors are at least partly due to inadequate 
trim compensation is verified in Figure 15, This figure shows likelihood 
function traces for the same flight transition maneuver but with different 
trim compensation filters. In addition, all test signals and other external 
excitation have been removed to highlight trim-induced errors. Two cases 
are shown, both using second-order washout filters of the form s /(s + 1, 5 
u)S + u ). In Case 1 u is 0. 5 rad/sec, and in Case 2 it is 2, 0. The traces 
clearly demonstrate that substantial trim transients exist when the washouts 
pass signals at low frequencies. For w sufficiently high, the transients are 
virtually eliminated. Comparisons of Case 2 and Figure 15 also indicates 
that second-order washout filters are dramatically superior to first-order 
filters. This can be explained by the ramp-like character of trim surface 
position during the standard transition maneuver. Second-order washouts 
remove ramps much more effectively than first-order washouts. 

Based on the above findings, improved second-order trim compensation 
filters (Method 2) were incorporated in the baseline identifier. Method 2 was 
selected over Method 1 because the latter requires second-order disturbance 
models for M and g/V in each Kalman filter channel in order to achieve the 
same performance benefits as three second-order washouts on q^, 

6^, with outputs fed to all channels. The plant model for Method 2 was 
changed slightly from that implied in Figure 14. It includes 6^ as a state 
variable in order to permit the identifier to utilize servo position as its con- 
trol input measurement. Details are given in the flow diagrams of Appendix A, 
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Figure 15, Likelihood Function Traces During Standard Flight Transition 
(Second Order Trim Compensation) 
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Tracking performance with these modifications is illustrated in Figirre 
16. This figure corresponds directly to Figure 5 for the baseline identifier. 
It is evident that improved trim compensation has reduced the tracking error 
problem. However, substantial errors still remain. These are due to 
limitations of MLE theory as discussed next. 

Tracking errors due to MLE limitations . - The second principal source 
of tracking errors can be attributed to fundamental limitations of constant - 
parameter MLE theory. These limitations can be appreciated most easily 
in terms of a new interpretation of the baseline parallel-channel algorithm 
which was developed in the course of the tracking error investigation. 


The new interpretation shows that the Newton-Raphson correction of the 
baseline identifier is entirely equivalent to a Kalman filter which estimates 
the "states”, ^ = c - , using a constant -parameter model, ^ 

and "measurements" corresponding to the min-L channel residuals. Based 
on known properties of Kalman filters, this interpretation immediately im- 
plies that the estimates will lag behind if X is in fact not constant. It also 
suggests that such errors cam be alleviated by using other models for the 
parameter process. In particular, we show below that appropriate models 
can be selected to derive the heuristic high-pass filters of the baseline 
identifier. More importantly, parameter models can be selected which give 
significantly improved tracking performance. 


Equivalence of (approximate) Newton-Raphson steps and Kalman filters . - 
First, we show the Newton-Raphson step (3) with approximate first and second 
partials equations (6) and (7) is equivalent to a Kalman filter. To do this, 
note first that the second partials approximation can be generated recursively; 
i. e. , 




I 

E 

k=l 


vykB 


-1 


-1 




(23) 


45 



■q ERROR 
PERCENT 


0 



Figure 16. Standard Tracking Traces with Gust Level Estimation 
and Second Order Trim Compensation 






Then P 


N 


■[ 


N*“X A ^Arri A ^Arp 

S ^ Vyj^B- vy^ + Vyj^B-1 


-1 




-1 


( 24 ) 


^N-1 “ ^N-1 ^N-1 ^N-1 


where the last step is based on the "Matrix Inversion Lemma" (ref. 4 ). 
Similarly, we can write the entire Newton-Raphson step recursively. 


Let ^ 


(25) 


Then 


"n 


A 4 A rp 


-1 


N 

D 
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^yk®‘^ '’k 


N-1 


= ®N ®N.r^ ®N-1 < S vy^B-1 V^) + Vy^B'^ Vjj (26) 
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+ Pn V 
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Now note that equation (24) implies 
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®N = I - ®N-1 ®N-1 ^ ®> * <27) 
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and 


Pn = ^N-1 Pn- 1 + ®>'^^y/PN-l’yN]B"'^ 


( 28 ) 


A A 


-1 




Substituting these into equation (11) gives 

^ = ■ ^_1 ■*■ ^N-l ^N-1 '*■ [''N ■ ^N-l] 


- 1 , 


Equations (29) and (24) can be recognized as Kalman filter and covariance 
equations for the following system model and measurement equation: 




(30) 


where v''^' is a white noise sequence with E(v'*^j^ * 

Hence, with proper initial conditions on equations (29) and (24), the 
approximate Newton-Raphson step, equation (3), is equivalent to a Kalman 
filter for a constant parameter process with "measurements" taken to be the 
filter residuals, equation (4), of the (i'!*=)-th parallel channel. Moreover, 
these "measurements" are treated as linear functions of the parameter error 
of that channel; i. e. , 


V 


N 



+ 


N* 


(31) 
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with "measiirement noise", v*, corresponding to the theoretical residual 
sequence (innovations) under assumptions c = ^ , 

Identification of time varying parameters . - With the above Kalman filter 
interpretation, extensions of the parallel- channel concept to time-varying 
parameters become self-evident. 

Case 1: First-order time variation: The simplest extension is to 
assume that the parameters are first order Brownian motion processes with 
growth rate instead of constants. Then the Newton-Raphson correction 
of Figure 2 would be replaced by the following Kalman filter: 

“n-1 = <33> 

Pn = ^N-1 - ^N-1 + S) v;/ (34) 

This filter provides first order tracking characteristics : zero steady state 
error for constant parameters, lag errors inversely proportional to 
Kvy = M Vy(Vy‘‘‘MVy + B) Vy'*' for ramp parameter changes, and unbounded 
errors for all higher-order parameter variations. These characteristics are 
much like the tracking behavior achieved with the heuristic high-pass filters 
added in Figure 2, In fact, the heuristic high-passes are entirely equivalent 
to equations (32), (33), and (34) for a particular choice of Q.\, namely 


with 

= exp(-At/T)» 
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To verify this, we substitute equation (35) into equations (32), (33), and (34) 
and work backwards through the steps in equations (23) through (29). First, 
consider the covariance equations. 


^N-1 ~ 


N 


•c A . 4 A rp “ 1 


•t A 4 A rp 


= {>" 


(36) 


A <1 A 


t1 ^ t) 

-1 J + ] 
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(N 

(k=l 


(N-k) „• 

M* Vyj^ B 


1 T) 

> 


Hence, [defined by equations (33) and (34)] is equivalent to of 
equation (23), except with exponentially deweighted summands. Similar 
arguments apply to the estimator equation. Rewrite equation (32): 






^N^^yN ^yN ''N' 
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Then reverse equations (27) and (28): 
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Now, substitute these results into equation (37): 


^ = p 


N 




^ N -1 ^-1 ■'■ ® %| 

-1 r -1 

-1 [ N-1 


^N-2 "*' '’^N-l ® 


■^N-l'] 


+ vj^ 


o 

o 

o 


(40) 


C - -D i V (N-k> -0-1 


k=l 


This is equivalent to equation (25) with exponentially deweighted summands. 
Hence, first-order Brownian motion parameter models result in the heuristic 
high-pass filters for appropriate choice of Q. 

Case 2: Second-order time variation: The filter [equations (32), (33), 
and (34)] can obviously be modified to track higher-order parameter varia- 
tions. For the F-8C in particular, ramp parameter variations are common 
during level accelerations, dives, or climbs. Zero steady state errors 
for these changes can be achieved with second-order parameter variation 
models such as the following: 
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\ = Sc-1 + ^k-1 \^, (41) 

“k = 

Kalman filters for this model work quite well for F-8C flight transitions. An 
example is shown in Figure 18, This figure compares the tracking per- 
formance of the baseline Newton-Raphson step (equation 3) with heuristic 
exponential deweighting against the performance of Kalman filters designed 
for model, equation (41), The flight transitions were generated with linear 
time- varying perturbation equations, and hence do not include tracking errors 
due to trim transients. They approximate rapid level -flight acceleration 
using a hypothetical engine three times as powerful as the F-8C*s. Standard 
random test signals were applied with less than 0. 04 g^s rms acceleration 
levels at the pilot station (ref. 1 ). Figure 17 clearly demonstrates the 
superiority of second-order parameter models for ramp -like parameter 
variations. 


Other Features 

In addition to these time variation solutions, the Kalman filter interpre- 
tation above suggests two other potential improvements of the overall identifier. 
The first concerns the use of residual data from several parallel identifier 
channels. Recall that the Kalman filter interpretation treats the min-L chan- 
nel as a sensor whose "measurement" is the channel's residual sequence. 

It follows that other parallel channels with small likelihood functions can be 
viewed as additional sensors and a single Kalman filter can be designed to 
combine several such channel "measurements". These sensors will have 
correlated measurement noise, of course, because each residual sequence 
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Figure 17. F-8C Identification (Concluded) 
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results from the same basic data sequence Y^. Sensitivity solutions would 
be required for each added channel (to get Vy) and, hence, a tradeoff between 
accuracy improvements and added computations is called for. These ques- 
tions were not investigated under the current program. 


The second potential improvement concerns the use of other external 
data about parameter variations. In the F-8C case, for example, an approxi- 
mate time derivative of q (and hence can be constructed from three - 

axis accelerometers and attitude sensors as follows: 


q 



A 

dt 


q 


jL ^ ^ 

2 dh dt 


V 


+ pV 


dt 


— 1 do dh 2 dV 
- ^ p dh dt dt 


Substituting the approximations 

-22 q. Reference [1] 

i 00001 m"^. Reference [5] 


gives 


dt 


dV 

dt 


V(sin 0 - O' cos 6 cos 0), 


a^ + aa - g (sin 6 • a cos 0 cos 0 ), / 
X z 


small 
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4-m 


2Mg r y2 

dt "^6o “ ~V + 200 000 ^ (sin e - or cos 0 cos 0) 


2M 


( 42 ) 


6o 


V 


+ aa^ - g(sin 0 - o-cos 0 cos 0) J 


As above, this data can be treated as added measurements in the parameter 
variation model to be incorporated directly in the Kalman filter design. The 
data can also be used to adjust the statistics of parameter variations on-line. 
This was done to generate Figure 17C. 


Theoretical Validity 

It is important to recognize that the parallel-channel concept with Kalman 
filter corrections instead of Newton -Raphs on steps is still an approximate 
solution of the theoretical "time-var 3 n.ng identification problem". After all, 
the identification problem posed by equation (1) with dynamics appended for 
parameters c is really a nonlinear filtering problem. These generally re- 
quired infinite dimensional solutions. The degree to which the parallel con- 
cept is valid, however, can be assessed qualitatively from equation (31). 

The concept depends fundamentally on the assumption that the residual se- 
quence of the min-L channel is equal to the theoretical innovations process 
plus linear fimctions of the parameter error. It can be shown that this 
assumption is fully satisfied under the following two conditions; 

• Parameters c enter only in the matrices G and D of 
equation (1). All other matrices are known. 

• The functional dependence of G and D on c is linear. 
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Because these special conditions assure linear residuals for all channel 
locations, they are further distinguished by requiring only one channel in 
the parallel-channel structxire. Under other conditions, equation (31) holds 
only approximately. The approximation is good if the min-L channel is 
sufficiently close to the true parameter value and if, simultaneously, the 
parameter rates of change are sufficiently small. 
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SECTION 4 

LATERAL ADAPTIVE CONTROL 


This section presents the design of the lateral axis adaptive algorithm. 

The design includes a first order Kalman filter that uses a maximum likelihood 
procedure to estimate air data dependent aircraft parameters. The filter is 
initialized by the pitch axis identifier and provides refined estimates of 
angle- of- attack, true airspeed, and surface effectiveness. These are used to 
schedule gains in an ”inertially coordinated" lateral control law. 

In addition we include inertial turn coordination requirements, param- 
eterizations and theoretical identif lability results for the lateral axis. 

Finally, we show the performance of the adaptive design on Langley* s F-8C 
simulator. 


Inertial Turn Coordination 

"Inertial coordination” is a way to achieve good dutch roll damping and 
good turn coordination at all angles of attack. The basic principle of the 
method is illustrated in Figure 18. It consists of maintaining stability- ax is 
yaw rate at the value needed to balance centrifugal and gravity forces along 
the body y-axis. This balanced condition corresponds to coordinated turns. 
The required rate is 


r^ = r - orp 

e (43) 

= COS0 sin0 

The inertial coordination principle has been used to develop several flight- 
quality lateral- directional control laws. One design is part of the F-8C 
CCV package (ref. 6 ). It was derived using optimal control theory with 


60 



V 



mg cos B sin 0 


mVr^ - mg cos 0 sin 0 + Y 
Y = 0 *’s ” V © sin 0= 0 


Figure 18, Inertial Turn Coordination 



quadratic penalties on control effort, on roll rate model- following error 
(p -p), and on the error (e) between actual and desired stability-axis yaw 
rate, i, e, , \ 

\ 

^ ~ (derived) “ 

„ ( 44 )^ 

= ^ COS0 sin0 - (r - ap) 

The latter was Included specifically to achieve turn coordination by means of 
inertial coordination. The block diagram that resulted after simplification is 
shown in Figure 19. It includes a dominant e-feedback to the rudder for 
damping and coordination plus various other state feedbacks and crossfeeds. 
The gains ^RPM scheduled with a. Their scheduling 

functions were developed from optimal controllers designed for a set of flight 
conditions. Expressions for the functions are given in Table ,3. 

A second lateral CAS using the inertial coordination principle but 
designed by frequency domain methods was flight-tested as part of the 
Air Force’s A-7D Multimode Program. Plight results have confirmed 
improved damping and turn coordination properties over conventional yaw 
dampers (ref. 7 ). 


'i«The error e is sometimes callecj a kinematic sideslip rate since it can be 
derived from an expression for ^ by assuming the side forces are zero 

(i, e. , Ypj3 + Yg^dr - 0). Then j§ = c^p - r + ^ sin0 cos0 which is equal to e. 
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TABLE 3.- LATERAL GAIN SCHEDULES 


Gain 

Function 


0, 5 Of 

-7,29ff + 0.54 
-2,0Qf - 0.274 
-0. 875 

<0.005 

0.005 <or < 0. 15 
0. 15 <or < 0.275 
0.275 

^RP 

0. 0474 

0, 54a + 0. 042 
0. 4 

O' < 0. 01 

0, 01 ^ a < 0, 3 
0. 3 < O' 

^RUM 

0. 0096 

0. 16 0^ + 0. 008 
0.05 

Of < 0. 01 

0, 01 < Of < 0. 3 
0. 3 < or 

^RPM 

0. 0095 

-0. la + 0.012 
0 

(2r < 0. 03 

0. 03 ^ or < 0. 12 

0, 12 < O' 


Accuracy Requirements 

The problem in implementing inertial coordination is the requirement 
for accurate estimates of angle- of- attack, true air speed, and aircraft 
attitude. These signals usually require external sensors and may cause 
reliability problems. 

The required air speed accuracy, for example, can be determined by 
assuming that the controller gains are sufficiently high such that 

e = Tg - :^cos0 sinci = 0 
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From Figure 19 the expression for side force then is 


mVr = mg cos9 sin0 + Y 
s 


and lateral acceleration Is 


N = ” = Vr„ - gcosd sin0 + A Vr_ 
y m s ® s 

= Vr^ - gcosd sin0 + AV ^ cos© sin0 
N = goose sin0 [-1 + + VPg 


Hence, AN due to velocity errors is 

y 


AV 

ANy = gcos0sm0 ^ 


(45) 


Now if we specify tolerable AN^. levels as 0, 02 g*s and let sin0 1 and 
cos© 1, we get 


!av/v| s 0.02, 

which indicates that ±2. 0 percent accuracy is required for the air speed data 
source. This number is pessimistic, however, because all coordination was 
assumed to come from e. In practice, some coordination is also obtained 
from direct feedback and from control surface crossfeeds. These con- 
tributors reduce the required accuracy to approximately ±5 percent. Similar 
accuracy requirements can also be derived for the angle- of- attack and attitude 
signals. 
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Identifier Design 


Signals with the above accuracy must usually be obtained from high- 
quality air data sensors and an all- attitude platform. The objective of the 
lateral identifier design task was to examine the potential of getting sufficiently 
good angle- of- attack and airspeed estimates on-line to remove the need for 
the air data sensors. As already noted in Section 3 the pitch-axis identifier 
alone falls well short of this goal primarily because the needed parameters 
are weakly identifiable in the baselined low signal pitch environment (ref. 1). 

It should be noted, however, that the inertial coordination requirements do not 
apply when signal levels are low. They are only important during significant 
lateral maneuvers, becoming progressively more severe as the maneuver mag- 
nitude increases. It is reasonable to expect that parameter values will be 
"more identifiable” during such large maneuver periods, and, hence, that the re- 
quired accuracy can be achieved by designing a separate identifier for the lateral axis. 

Design approach. - The lateral identifier was constructed in accordance 
with the MLE design procedure already developed for pitch (ref. 1 ). The 
first step of this procedure calls for model selection and parameterization. 

The next step is a theoretical identifiability study to verify that the desired 
goals can be achieved and to isolate significant parameters in the model’s 
parameterization. This is followed by detailed identifier design, and, finally, 
by simulation verifications. Results of these steps for the lateral identifier 
are summarized below. 

Lateral model and parameterization, - Inner loop lateral- directional 
dynamics are usually represented by a fourth-order linear model with roll 
rate, yaw rate, angle- of- sideslip, and roll angle as state variables 

T 

X = (p, r, |3, ) 


66 



and with the following inputs and measured outputs: 

u = (5^, 
y = <Pm' 

For purposes of identifier design in large maneuvers, this model was simpli- 
fied to first-order by treating p, r, and 0 as known inputs with |3 as the only 
state variable. The resulting model is 

i B - V + [-' « 7 ’^5, ’fjJ % ♦ «vs5 

(46) 

with u defined by 
m 

T 

u = (r , p , gcos0 sin0 ,6 ,6 ) 

m m' ^ m ^m' r a 

m m 

The unknown coefficients of this model areof, 1/V, (Y^V), (Yg^V), and 
(Yg^V), These were parameterized in terms of known estimates from the 
pitch axis identifier plus six new unknown small perturbations The 

parameterization is shown in Table 4. 

Theoretical identifiabllity . - As the next step of the design process, an 
evaluation was made of the theoretical accuracy to which the six new param- 
eters Iplus gust level, o^g, and initial condition, |3(o)] can be identified 
during large lateral maneuvers. The methodology for these evaluations is 
described in (ref. 1 ) and reviewed in an earlier section. Results are 
summarized in Figures 20 through 25, 
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TABLE 4,- LATERAL MODEL PARAMETERIZATION 



A 

*(M» ), a . and V are estimates from the pitch axis identifier, 
oo p p p 


**A priori uncertainties are taken from pitch axis identifier performance and from 
Table 13 (ref. l ). 




Data length (sec) 


Figure 20. 


Theoretical Identification Accuracy 
1 

Parameter: ^ , Large Maneuver 





Figure 21. Theoretical Identification Accuracy- 
Parameter: or, Large Maneuver 


70 


RMS error (7o) 


I 



2 3 4 5 

Data length (sec) 


Figure 22. Theoretical Identification Accuracy 
Parameter: , Small Maneuver 


71 



RMS error (%) 








Figures 21 and 22 show theoretical identification errors for 1/V 
and Of respectively, as a function of data length for a large rolling 

maneuver and three gust intensities. The RMS sensor noises (for a 100- 
radian bandwidth) were: 

• Rate gyro (yaw, roll) 0,15 deg/sec 

• Bank angle 0. 25 deg 

• Surface positions (6_ , 6^) 0. 04 deg 

• Lateral accelerometer 0. 003 g 

The maneuver consisted of a square wave sequence of ±50 deg /sec roll rate 
commands with a period of four seconds. The curves verify that the required 
inertial coordination accuracy is at least theoretically achievable within one 
to two seconds after the maneuver is initiated. 

Figures 23 and 24 show similar results for a much smaller maneuver, 

±5 deg/sec. As expected, accuracy for this case is poorer. However, it still 
meets the relaxed requirements of inertial coordination at small roll angles. 

Figures 25 and 26 show accuracy predictions for the large maneuver 
case when only three of the six parameters in [plus 3(o)] are recognized 
by the identifier. This is commonly called "reduced parameter Identification, " 
It achieves poorer performance than the full parameter case because errors 
in the unrecognized parameters contribute to incorrect identification. As 
seen from the figures, however, these contributions are small enough to 
justify the reduced parameter approach. 

Detailed design. - Based on the above identifiability findings, a three- 
parameter MLE identifier was developed to estimate ^L3' 

As shown in Table 4, these correspond to small deviations from pitch-axis 
estimates of a, 1/V, and M^^, respectively, A block diagram of the identi- 
fier is shown in Figure 26. It uses a single parallel Kalman filter channel 
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which is not fixed in parameter space, as the pitch-axis channels are, but 
rather moves around to follow the pitch estimates. The usual single Newton- 
Raphson correction is taken from its current location to reach the final 
estimate. Models for the Kalman filter and sensitivity filters of the identi- 
fier were developed by discretizing equation (46) to first order terms and 
rearranging the input vector, u^, for greater computational efficiency. 

Details are provided in the flow diagram of Appendix A. 

Simulation verification. - Because of the transient nature of lateral 
identification (i. e, , good accuracy achieved only during large maneuvers) 
the lateral identifier was not evaluated in an open- loop fashion with emphasis 
on identification errors. Instead, it was evaluated closed loop — lateral 
estimates {a, 1/V) used to schedule the inertially coordinated CAS of Figure 18, 
Table 3 -- with emphasis placed on the damping and turn coordination achieved 
by the overall adaptive system. Investigations were carried out on NASA 
Langley's F-8C simulator at FCl, FC5, FC8, and FCIO, As defined earlier, 
these flight conditions correspond to a middle- of- the- envelope condition, a 
low-q condition, a supersonic condition, and a high-dynamic-pressure condi- 
tion. Time histories from the simulator are given in Figures 27 through 34. 
The adaptive system's performance (labeled ”MLE") is compared in these 
figures with two other lateral- directional controllers. One is the lateral 
CAS from the baseline adaptive program (ref. 1 ). This is labeled "RM, " 
for reduced measurement. The second is the same inertially coordinated CAS 
of Figure 18, Table 3, but scheduled with perfect values of angle- of- attack 
and velocity. It is labeled "IC. " 

Comparisons of these three systems are shown for rolling maneuvers 
and followed in the succeeding illustration with step /3 gust responses. The 
first displays turn coordination quality in terms of the and |3 magnitudes 
developed during a turn. The second displays dutch roll damping. It is 
apparent from these comparisons that the adaptive system (MLE) matches 
the damping characteristics of the perfectly scheduled one (IC) quite closely. 
Both are significantly better than the baseline system (RM), 
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Figure 28. Step B Gust Responses, FCl 













Figure 32. Step B Gust Responses, FC8 
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Figure 33. Rolling Maiiuevers, FCIO 
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The turn coordination comparisons show a close match of the N^. traces 
for the MLE and IC systems but larger |3 excursions for MLE, These 
excursions are no larger, however, than those of the RM system. Since the 
latter meets all turn coordination requirements for the F-8C (ref. 6 ), the 
MLE system is also satisfactory. 


Although the above comparisons are limited in scope, they suggest that 
good turn coordination and dutch roll damping without conflict can indeed be 
achieved with on-line identification and no air data. The technique is worthy 
of further investigation and eventual flight test. Topics of particular interest 
for further study include direct estimation of the error quantity, e, instead 
of its scheduling components of and 1/V, and replacement of the Newton- 
Raphson step in Figure 27 with Kalman filter corrections as described in 
Section 3. 
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SECTION 5 

ANALYTICAL REDUNDANCY 


The objective of this task was to examine analytical redundancy within 
the context of the existing structure and computations of the baseline 
MLE identification algorithm. This task was motivated by the recognition 
that most analytical redundancy approaches use Kalman filters of the type 
already avaUable within the identifier to perform failure detection and 
isolation functions. Three candidate concepts were developed and tested on 
NASA's F-8C simulator. Simulation results indicate the feasibility of these 
preliminary designs. Objective performance standards for analytical re- 
dundancy were then derived from flight safety and mission reliability require- 
ments. Further evaluations of the concepts are recommended to demonstrate 
that these performance standards can be achieved. 


Review of Analytical Redundancy Procedures 

Analytical redundancy is based on exploiting known dynamic and kinematic 
relationships to estimate sensor outputs. These estimates are useful in de- 
tecting sensor failures. In this section published procedures are reviewed 
to identify suitable techniques for the F-8C application. 

A number of failure detection approaches were suggested by R. K. Mehra 
and J. I. Peschon (ref, 8 ) based on the theoretical properties of Kalman 
filter residuals. Tests that apply to Kalman filter residuals include: 

• Tests of whiteness - The residuals should be independent 
at different time instants, 

• Tests of mean - Sample means should be zero. 

• Tests of covariance - Covariance of residuals should equal 
apriori values. 
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Another alternative related to the test of whiteness is the test of orthogonal- 
ity: The residuals and the estimated measurements should be uncorrelated. 

The notion of using Kalman filters as the failure detection device was 
applied by Meier, et, al. (ref. 9 ) and later by Maybeck (ref. 10) to the F-4 
sensor complement. Each Kalman filter processed several sensors. In 
addition, isolation of the failure was usually accomplished by noting a large 
filter residual for that sensor and failure indications from other Kalman 
filters. 

Kerr (ref. 11) reported a different approach based on suboptimal Kalman 
filters. The state was augmented with failure states (whose zero implies no 
failure) and a test was designed to detect departures from the "no failure" 
trajectory. Isolation of the failure was accomplished by combining groups of 
tests, each with an appropriate set of failure states. This test is intended 
for filters that are known to be suboptimal (i. e. , reduced order) and hence 
do not produce residuals with known theoretical properties. 

Montgomery et. al. (ref. 12) have used multiple hypothesis tests to detect 
and isolate failures. A bank of Kalman filters generate sensor residuals 
under a set of different hypothesis. These residuals are accumulated as 
likelihood functions with the minimum function indicating the current most 
likely hypothesis. 

Other researchers such as Willsky (ref. 13) have developed generalized 
likelihood ratio methods to reduce the complexity of hypothesis tests. Those 
techniques use one Kalman filter. Its residuals are correlated against stored 
sets of residual responses, one for each hypothesis. The highest correlation 
then indicates the most likely h 3 rpothesis. 

At this point it is apparent that a common element in many of these fault 
detection procedures is the Kalman filter. This element is also a key part of 
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the F-8C MLE adaptive algorithm. Therefore, it seems reasonable to btiild 
analytical redundancy concepts around the Kalman filters that already exist 
in the adaptive system. Those concepts model the short -period motion of 
the pitch axis and use a rate gyro and an accelerometer as input sensors. 

In the next section three specific redundancy concepts are developed to detect 
failure of these sensors. Each concept is based on monitoring filter resid- 
uals or likelihood functions to detect sensor failures. Isolation is accom- 
plished by including hardware comparison of like sensors or other analytical 
tests. 

Specific designs for the F-8C, - Two designs had the objective of detect- 
ing and isolating a failure in a dual channel sensor set. The third design 
was aimed at detecting a sensor fault in a single sensor complement but was 
not required to isolate the failure. 

The first two designs use the existing set of pitch axis Kalman filters 
augmented with one extra channel to process measurements from redundant 
sensors. Both designs are based on comparing likelihood functions from the 
minimum -L channel with the redundant channel. The model and filter gains 
in the redimdant channel are slaved to the minimum-L channel determined by 
the adaptive algorithm. The only difference between these two channels is 
the set of measurements they process. The structure is shown in Figure 
35. Large deviations in the two likelihood functions indicate that one set of 
measurements is inconsistent (i. e. , a sensor failure). Since likelihood fimc- 
tions are used for comparison, the larger one will be the result of the failed 
sensor. 

The third design processes the filter residual of a single channel 
only. 

Design details for the three concepts are discussed in the remainder of 
this section. 
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Sz sufficiently positive 
Indicates set 1 failed 
Sz sufficiently negative 
Indicates set 2 failed 


Extra channel operating 
(I*) - 

atjL= C 


Figure 35. Analytical Failure Detection - Designs 1 and 2 


Design 1: The objective of this design is to detect and isolate sensor 
failures in two redundant sensor sets. The detection is performed by com- 
parison monitoring of like sensors, and isolation is accomplished with an 
analytical test of the difference of likelihood functions as shown in Figure 35. 

The isolation logic can be described in the form of a truth table, 

(Table 5), Let I- = 1 indicate a miscomparison of the two gyros, I =1, 
s 3. 

a miscomparison of the two accelerometers, and = 1, an analytic failure 
indication for sensor set 1. Then simple combinations of these error flags 
will detect and isolate failures in each of the four sensors since the error 
flag pattern is unique for each hypothesis. 
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TABLE 5. - FAULT ISOLATION LOGIC 


Sensor failed 

Error flag 


I 

a 

'ar 

None 

0 

0 

0 

Gyro 1 

1 

0 

1 

Accelerometer 1 

0 

1 

1 

Gyro 2 

1 

0 

0 

Accelerometer 2 

0 

1 

0 


The analytical failure flag, I , was mechanized by testing the statistic 


'K ■ V’ - - <V‘*’ - - <h"‘’ - H-1® 


(47) 


for presence of biases. This statistic was selected because it is sensitive to 
sensor failures but not sensitive to errors introduced by anticipated deviations 
between true aircraft parameters, c = c., and Kalman filter parameters, 
c - ^ \ To see this, recall that the residual for the (i*)-th Kalman filter 

(with sensor set 1) is 



Yj^(c^) - yjc 


(i*) 


), 


k = 0, 1,2 . . . 


It 


can be expanded in a power series about the true parameter c^ as follows: 


(i^'O _ 




(i*),,.(i=?^) 


= yk<£^.) - 7k (£t> - ’''7k *• 


(48) 
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Here, ^ is the theoretical zero-mean white residual sequence, y' ^ is 
the optimal estimate, and Vy is the gradient of the optimal estimate with 
respect to Q, The analogous expression for the redundant sensor set 2 is 



P (R) 


(R) r.m 


- V ' (£ 


c. ) + h. o. t. 


(49) 


Note that ^ is again a zero-mean white noise sequence which is correlated, 
in general, with the sequence \ 


Equations (48) and (49) substituted into equation (47) provide the follow* 
ing power series expression for the test statistic 




(50) 








Under normal no-failure conditions, the usual theoretical properties of 
Kalman filters apply to this expression. In particular. 


= 0 , 


= 0 , 



0 , 

0 . 
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Furthermore, if we assume that the two sensor sets have identical noise 

(isic) (I^\ 

statistics, then ? and^ are identically distributed sequences, as are 
^fi^) */T>\ 

Vy^ ' and Vy' \ It then follows that E(z) = 0 regardless of the parameter 
error (at least up to 2nd order terms). 

In the event of sensor failure, of course, one of the likelihood functions 
(i*) (R> 

L' or L will increase beyond its normal no-failed value. The test 
statistic, z, will then develop biases (positive for sensor set 1 failure and 
negative for sensor set 2) which can be detected by statistical decision 
procedures. 

The decision procedure selected for Design 1 was the so-called sequen- 
tial likelihood ratio test (ref. T4). It is based on the following function 

_ • • • ^k> 

^ik f^ ^^i • * * ^k^ 

where is a likelihood ratio, i is the starting sample, k is the current sample 
(at time t^^), f^ is the distribution of the test statistics under hypothesis (no 
failure) and f^ is the distribution under hypothesis (sensor failure). 

The test is; 

Accept if ^ A 

Accept Hq if ^ B 

Continue test if A < A.j^ < B 

+ 

If the test statistic, z, has a normal distribution and the two hypothesis 
correspond to different mean values, the test reduces to comparing the sum 


4> 

This is not quite true for the statistic in equation (50), but convenience 
outweighs rigor. 
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against the following thresholds : 



— o[ < T) z , < 

i\^i - M'n) I 


(k-i)(|i.Q + |j.j) 


where and are the means corresponding to hypotheses and H 
respectively, and is the variance of the test statistic. 

Parameters for these thresholds were set at 


^0 = 0 

A = 1/B = 10'^ 

1 3, 9 CT for Sensor Set 1 Failures 

-3. 9 <T for Sensor Set 2 Failures 

Estimates of cr for no-failure conditions were obtained from the F-8C simu- 
lation under a variety of commands and gust disturbances. The test was 
initiated whenever either of the two simulated g 3 mos or accelerometers 
triggered the hardware comparators, 1^ or I^, Thresholds for the latter 
comparators are discussed later in this section, A pictorial summary of 
Design 1 is shown in Figure 36, 

Design 2: This design had the same objectives as Design 1. However, 
instead of initiating the analytical test upon miscomparisons of like sensors, 
the test was run continuously, A sequential test of the mean was initiated 
with each sample and carried forward for a fixed period of time. Each new 
test contained its own summation of the test statistic and its own expanding 
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was 


threshold. These were compared at each sample, and failure flag, 
set if any summation exceeded its threshold. For F-8C simulator evalua- 
tions, a time period of one second was selected for the maximum test length. 
At 32 samples per second, this translates into 32 simultaneous sequential 
tests. A pictorial summary of this design is shown in Figure 37. Note that 
Design 2 may require larger thresholds than Design 1 since no false alarm 
rejection is provided by the comparator. 


Design 3: The objective of the third analytical redundancy design was 
simply to detect failures of either the gyro or accelerometer in a single 
sensor set without providing isolation. Hence, this design used residuals 
from the min-L channel only and included no hardware comparators or re- 
dundant channel data. 


The design was again based on the sequential likelihood ratio test. Be 
cause no redimdant data was available, the test statistic was taken to be a 
direct combination of Kalman filter residuals. 


k CT 


— (N - N 
Nz ^ ^ 


Unlike the difference of likelihood function, this statistic is sensitive to 
parameter errors as well as sensor failures. The thresholds associated 
with the sequential likelihood ratio tests were therefore set significantly 
larger than those of Designs 1 and 2. In all other respects the test was 
identical to Figure 37. 


Simulation Evaluations 

The three analytical redundancy concepts above were briefly evaluated 
on NASA Langley's F-8C simulator to examine their general performance 
potential. The evaluations consisted of a number of trial "flights" under 
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different signal levels and failure mode conditions. The failure modes 
considered and performance results are summarized below. 


Sensor failure modes . - Realistic failure modes are needed to assess the 
performance of any concept for failure detection. Various sensor failure 
modes have been hjrpothesized. Some studies (refs. 9 , 10) have categorized 
the failure modes as either 

• Sudden failures with sudden effects 

• Sudden failures with drifting effects. 

For this study the the common failure mechanism of a rate gyro and the 
normal accelerometer were identified (refer to Table 6). The various faults 
were then reduced to the following modes : 

• Zero output 

• Zero to hardover step output 

• Output sticks and remains at one value during a transient 

• High hysteresis 

• Low gains. 

This mode set is considered inclusive of all significant failures of the 
sensors in question. Table 6 relates particular sensor faults for the rate 
gyro, accelerometer and position transducer to the above categories. Note 
that many specific failure modes of individual sensors can exhibit one or 
more of the above mode characteristics. 
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TABLE 6. - SENSORS FAULT CATEGORIES 


Fault 

Mode 

Rate g 3 H?o (spring restrained) 


• Open spin motor winding 

(1) 

• Open pickoff winding 

(1) 

• Shorted spin motor winding 

(1), (4), (5) 

• Shorted pickoff winding 

(1), (5) 

• Broken torsion spring 

(2) 

• Frozen gimbal 

(3) 

• Gimbal stiction 

(4) 

• Open or shorted demodulator 

(1), (2), (5) 

Accelerometers (electrical force balance) 


• Open or shorted feedback electronics 

(1), (2), (5) 

• Mass stiction 

(4) 

• Frozen mass 

(3) 

Position transducer 


• Open pickoff 

(1) 

• Shorted pickoff 

(1), (5) 

• Pickoff stiction 

(4) 

• Frozen pickoff 

(3) 


Note: 

(1) Zero output 

(2) Zero to hardover step output 

(3) Output sticks and remains at one value during a 
transient 

(4) High hystersis 

(5) Low gains 




Performance Summary 


The performance potential of the three analytical redundancy concepts 
was examined by comparing their detection/isolation capability against a 
"performance standard" achieved by ordinary hardware comparators of like 
sensors. The latter consists of simple threshold comparison logic 

V ° ^ ’ychl ■ ych2' > Threshold 

with thresholds set according to Table 7. Table 7 represents typical com- 
parator thresholds in operational systems. Only the first term of each 
threshold was used in the simulation because alignment and scale factor 
errors which motivate the remaining terms were not included in the sensor 
models. 


TABLE 7. - TYPICAL COMPARATOR THRESHOLDS 


Sensor 

Threshold 

Rate gyro 

4/3 * [.0255 * iFSl + .035 * Iq| + .866/57. 3 Ip)] 

Accelerometer 

4/3 * [.012 # iFS] + .056lN^| ] 


FS = full scale output 


Detection/ isolation capability was evaluated for all five failure modes 
(per sensor) and for five signal levels : 


1) Adaptive test signal only 

2) 1 m/sec turbulence 

3) 2 m/sec turbulence 

2 

4) C'f- command = 3 m/sec 

2 

5) command = 10 m/sec 
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Results for the hardware comparison "standard" are shown in Table 8, 

It should be noted that the standard is not perfect. "Covert" failures 
(denoted by arrows) require significant excitation (either gusts or commands) 
in order for the failure to be detected. This is of interest since these covert 
failure modes will be examined with anal;^ical redundancy to determine the 
corresponding signal levels. 


TABLE 8. - COMPARATOR PERFORMANCE^ 


Failure simulated 

Excitation, 




C*=3 m/s 

C>!«=10 m/ s 

Gyro — Dead 

0 

X . 

X 

' 

X 

X 

Gyro--H. O, 

X 

X 

X 

X 

X 

Gyro — Stuck 

0 

X 

X 

X 

X 

Gyro — 50% Gain 

0 

0 

0 

0 

X 

Gyro — Hyst. 

0 

0 

0 

X 

X 

Accel — Dead 

X 

X 

X 

X 

X 

Accel — H. O. 

X 

X 

X 

X 

X 

Accel — Stuck 

0 

0 

X 

X 

X ^ 

Accel — 50% Gain 

X 

X 

X 

X 

X 

Accel — Hyst. 

0 

X 

X 

X 

X ^ 


X = Failure detected 


Results for the three analytical redundancy designs are shown in Table 9, 
Note that all tests can detect the overt failures but the ability to catch covert 
failures varies. Specific failure detection is depicted by the corresponding 
design number given in the table. Time histories for representative condi- 
tions are given in the Appendix. 

Qualitative conclusions which can be drawn from comparisons of Tables 
8 and 9 are summarized in Table 10. 
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TABLE 9. - PERFORMANCE SUMMARY FOR ANALYTICAL 
REDUNDANCY DESIGNS 


Failure simulated 


Excitation, 


3F/s gust 6F/S gust C>'^ = 10 C''^=30 


•Dead 
•H.O. 
•Stuck 
•50% Gain 
•Hyst. 


1 

1,2,3 

1 


1,2 

1,2,3 

1,2 

1,2 

1 



Test 


TABLE 10. - ANALYTICAL REDUNDANCY 
CONCLUSIONS 


Obiective 


Performance 


. ... ... .... ... 

Detect and isolate one of 
two channels 

Almost as good as hardware 
comparison to detect and 
isolate one of three channels 

Detect and isolate one of 
two channels 

Not as good as Test 1 

Detect failure in one 
channel 

Not as good as hardware 
comparison to detect failures 
in one of two channels (no 
isolation) 


Test 3 catches overt failures 
only 


X 
















Sensor Fault Detection Requirements 


While the simulation results show promising failure detection/isolation 
potential for at least one design, these results are preliminary in nature and 
much additional evaluation effort will be required to fully assess the designs. 

In order to establish objective goals for such future evaluations, an effort 
was made to derive qualitative performance requirements for analytical 
redundancy concepts in general. Now, we will discuss these derivations. 

They show that analytical failtire detection tests must reach missed alarm 
rates less than approximately 3. 0 percent in order to be competitive with 

direct voting schemes using redundant hardware. False alarm rates, of 

-3 

course, must also be acceptable 10 /flight hours). Further Monte Carlo- 
type simulations are recommended to evaluate the analytical redundancy 
designs against these requirements. 

Bam c flight control reliabilities . - The contributions of automatic flight 
control systems to aircraft effectiveness have increased the reliance on their 
operation for satisfying mission and flight safety requirements. These re- 
quirements are often quantified as probabilities. For example, the probability 
of a catastrophic failure must not exceed approximately 10 per hour of 

flight (one chance in ten million). Mission abort probabilities are on the 

-3 

order of 10 per flight hour, (ref. 15). 

In spite of continual improvements in component quality, a non -redundant 
electronic flight control system still exceeds these allowable fly-by-wire 
flight safety failure rates by about a factor of 1000 (ref, 15), Thus redundant 
configurations are a necessity. 

Various levels of redundancy are commonly classified according to the 
ability of the system to accommodate failures; e. g, , "fail safe", "single- 
fail-operate" or "dual-fail-operate". The single and dual refer to the number 
of like failures that can be tolerated without loss of system function. Failure 
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detection is primarily accomplished by comparison monitoring of like out- 
puts. With this limitation the following parallel between failure accommoda- 
tion level and redundancy configuration are common (ref. 16). 

• Fail safe 2 channels 

• Single-fail-operate -» 3 channels 

• Dual-fail-operate -* 4 channels 

Basic sensor reliabilities . - Because analytical redundancy procedures 
are primarily concerned with sensor failures, it is useful to consider that 
fraction of the above flight control requirements which is allocated to the 
sensors. Conservatively, this will be 10 percent of the total budget. This 
allocation is then further subdivided among individual instruments. Assum- 
ing a complement of 10 sensors gives: 

-9 

Probability of total failure ^ 10 per sensor per hour 

-5 

Probability of mission abort ^ 10 per sensor per hour. 

As with the overall flight control system, nonredundant sensors fall 

well short of these requirements. Current failure rates for rate gyros, for 

-4 

example, are 10 per hour (one of the worst of the sensor failure rates). 
Hence, redundant sensor configurations are also a necessity. 

Reliabilities for redundant configurations . - To examine the reliability 
characteristics of redundant sensors, consider a fly-by-wire application with 
quad sensors. The usual approach to management of the set of four is to 
isolate the first and second failed sensors by majority vote, with the third 
failure (sensed by a miscomparison between the remaining two sensors) 
resulting in total disengagement. If the monitoring process is perfect, the 

3 

probability of total failure of the set is approximated by 4Q , where Q is the 

s s 

probability of failure of one of the sensors in the selected time period. Under 
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2 

the same assumption, the probability of failure of any two sensors is 6Q , 

s 

a number of significance to the mission abort probability. In terms of 
current sensor failure rates, the above probabilities are exceedingly small 
numbers. Taking a rate gyro as an example gives 

3 

Probability of total failure = 4Q 

s 
2 

Probability of mission abort = 6Q 

i5 

where each applies to a one -hour flight. Consequently, the quad sensor set 
(with perfect monitoring) exceeds requirements by about two orders of 
magnitude. This appears to be an overdesign. 

If a majority- voted triple set were hypothesized instead of the quad, 

2 

however, the associated flight safety and mission abort probabilities of 3Q 

—8 —4 ^ 

and 3Q would produce values of 3 x 10 and 3 x 10 , respectively. These 

s 

values fall short of the above requirements by a factor of 30. The situation 
is simply that with conventional comparison monitoring, triple is not good 
enough and quad is too good. 

Complicating the above argument (and changing some of the conclusions) 

is the issue of nonperfect monitoring, which in itself is difficult to deal with 

quantitatively. One attempt to do so argues that a nondetected failure may 

cause quad set failure after the second sensor failure (instead of after the 

2 

third), producing an added total failure contribution of 6Q^ Qjn 

is the probability of having the first failure occur without being detected and 
that both of the actual sensor failures are alike. The result of such a combi- 
nation of events is that the quad voting logic cannot decide with two good like 
sensors versus two bad like sensors. A common example of this situation 
is having two sensors fall dead in an interval where insufficient control 
activity (e. g, , cruise) occurs to trip monitors. There is no data available ' 
to assign numbers to hut a parametric study of its potential effects soon 


= 4 X 10“^^ 

= 6 X 10“^ 
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convinces one that it is a significant and probably a dominant contributor to 

total failure rate. For example, speculated values for Q are in the order 

—2 2 ^ —9 

of 10 , making the 6Q Q term (again for a rate gyro) equal to 6 x 10 

for the one-hour flight, just within requirements. So now with imperfect 

monitoring considered, the quad set may no longer be "too good", but just 

good enough. 

The relevance of the above discussion to anal 3 rtical redundancy require- 
ments lies primary in the notion that imperfect monitoring (an element of 
redundancy mismanagement) is probably the pacing cause for failure of high- 
ly redundant sensor sets. The quality of the required anal 3 rtical diagnostics 
must be viewed in this perspective. Consider, as an example, an analytical 
redundancy application wherein triple sensors are to be configured for dual- 
fail-op performance. The first failure will be "voted out" by comparison 
logic. The second failure will be detected by comparison monitoring and 

isolated by the analytical diagnostic. The resulting total failure rate is 
3 2 

Q + 3Q Qp., where the second term represents the probability of a dual sen- 

S S ±J 

sor failure and is the probability of failure of the diagnostic to pick the 

bad sensor. Judging the second term to be dominant and equating it to the 

-9 

10 requirement speculated above, 

3Q^Qj3 = 10"^ 

or = 0. 033 for a rate gyro set, meaning that the analytical test must be 
correct in about 97 percent of the decisions made to distinguish a good sensor 
from a bad sensor. This performance appears feasible. Note also that the 
source of failure experienced in the conventional quad set due to imperfect 
monitoring is also present in the above triple set, but it is half as probable 
in the triple. It may simply be included as a contribution to Qj^. 
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In terms of mission reliability, the triple set speculated above will be 

2 

aborted after the second failure, a probability of 3Q . This is lower than the 

s 

quad set by a factor of two. 

The above reliability figures for qtiad and triplex systems are summar- 
ized in Table 11. A similar application of analytical redundancy can also be 
made to dual sensor configurations (see Table 12). Here it is assumed that 
another backup system is available. Thus if the dual sensors disagree, the 
system can be safely disengaged. Referring to Table 12, it is noted that a 
dual sensor system does not meet mission abort requirements. This can be 
greatly improved if analytical redundancy is used to select the remaining 
good sensor. By comparing system failure probabilities and mission abort 
probabilities, a probability of a correct decision of 95 percent satisfies 
typical specifications. That is, a 5 percent missed alarm rate is adequate 
for the analytical diagnostic in this application. 

Both Tables 11 and 12 suggest that analjdiical redundancy concepts can 
make meaningful contributions to overall system reliability even with modest 
performsince capabilities. Based on these findings, it is recommended that 
work on Design 1 be continued. The benefit of maneuver dependent thresholds 
should be examined and flight data should be used to verify that the decision 
quality of the algorithm can be made to satisfy the above requirements. 
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TABLE 11. - RELIABILITY CHARACTERISTICS OP QUAD 
AND TRIPLEX SENSOR SYSTEMS 


Typical 

specification 

Failure probability for selected redundancy structures 

Quad, 

perfect 

monitor 

Quad, 

with imperfect 
monitor 1 

Triplex 

Triplex with 
anal 3 itical 
redundancy® 

System failure 
-9 

{10 per sensor) 

4Qg = 4x10"^^ 

4Qg + = 0.6x10“® 

3Qg = 3x10"® 


Mission abort 
-5 

(10 per sensor) 

6Qg = 6x10"® 

6Q^ = 6x10"® 
s 

3Q = 3x10"^ 
s 

3Q^ = 3x10"® 


NOTES; 

1Qj, = 0,02 

^ Qj, = 0. 033 


TABLE 12. - RELIABILITY CHARACTERISTICS OF 
DUAL SENSOR SYSTEMS 


Typical 

specification 

: — 

Failure probability for selected redundancy structure 

Dual 

Dual with analytical redundancy 

Total system failure 
(10 per sensor) 

0* 

q2Qd = 10-3 

(If Qj, = 0. 01) 

Mission abort 
-5 

(10 per sensor) 

2Q^ = 2x10"“^ 
s 

2Q^Qd = 10-® 
(If = 0.05) 


Alternate backup assumed. 
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SECTION 6 

CONCLUSIONS AND RECOMMENDATIONS 

The extension studies documented in this report have examined three 
areas of refinement for the baseline F-8C adaptive control system designed 
in (ref. 1 ) . 

• Accuracy improvements for pitch axis identification 

• Lateral axis identification 

• Analytical redundancy techniques 

Significant results were achieved in each area. 

The pitch study has shown that on-line adjustment of gust level statistics 
improves accuracy of the baseline identifier and/or reduces test signal re- 
quirements. It can be readily implemented by discrete gust level discrimi- 
nation techniques. A two-level case was demonstrated which adds a single 
parallel channel and a second set of stored filter gains to the identifier. 

These extra elements are recommended as permanent modifications of the 
baseline design. Accuracy improvements have also been demonstrated for 
rapid flight transitions. These were achieved with better trim compensation 
and with basic modifications of the underlying MLE design theory. The latter 
results replace the baseline identifier's Newton -Raphs on correction step with 
a Kalman filter correction step designed for d 3 mamic parameter models. 

This change is also recommended as a permanent modification of the baseline 
design. The only negative result of the pitch-axis study is that attitude data 
provides no significant accuracy improvement. 

The lateral-axis study has shown that inertially coordinated command 
augmentation is feasible without air data measurements. A lateral MLE 
identifier was designed with sufficient transient accuracy (during large 
maneuvers) to schedule the full state lateral CAS (ref. 6 ). The combined 
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lateral adaptive system exhibits excellent dutch roll damping and good turn 
coordination. Further study of this concept is recommended, with emphasis 
on simplifying the identifier. 


Finally, the analytical redundancy study has shown that the baseline 
identifier, augmented with one additional parallel channel to process re- 
dundant sensor data, has significant capabilities for fault detection and 
isolation of gyros and accelerometers. Although evaluation results in this 
area are limited, they indicate that at least one of three suggested analytical 
redundancy procedtires is worthy of further development and evaluation. 
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APPENDIX A 

PITCH AND LATERAL 
IDENTIFIER FLOW DIAGRAM 
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Cycle 2 : Significance Test and Change Logic 
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c Return 


Cycle 5 : Parameter and Gain Updates 
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Appendix A 


The lateral model defined in this cycle accepts the following quantities 
as inputs and outputs 

y = Ny - (Yg^V) Cr„ - (Yg^V) 8a^ - d ^ 


y* = low passed version of y 


At [g cos sin 4 ,^ + (YgyV) + 


^(YarV) 6r^ + (Y^^V) 5a^] 

At t(Y5rV) er^ + (Yg^V) 5aJ/Vp (Mg^)p 


U- = low passed version of u 


Cycle 6: Lateral Model Definition 




APPENDIX B 

ANALYTICAL REDUNDANCY SIMULATION 
TIME HISTORIES 



Appendix B 


APPENDIX B 

ANALYTICAL REDUNDANCY SIMULATION TIME HISTORIES 


This appendix contains some representative time histories that illustrate 
the performance of the analytical redundancy concepts. Both normal opera- 
tion and simulated failures are considered for a variety of input conditions. 
The cases are given in Table B1 below. 

TABLE Bl. REPRESENTATIVE TIME HISTORIES 


Figure Condition 

Bl Residuals and likelihood differences at FCl with no 

failure and test signal plus sensor noise (TS + SN), 

2 m/s gusts. Thunderstorm (7 m/s gusts) and 0=^" 

command 

B2 Simulated accelerometer failure - high hysteresis 

at FC 1 

B3 Simulated accelerometer failure - stuck at FCl 

B4 Simulated gyro failure - high hysteresis at FC 1 

B5 Simulated gyro failure - dead at FCl 

B6 Simulated gyro failure - low gain at FC 1 

B7 Residuals and likelihood differences at FCIO with no 

failures. Test signal and sensor noise (TS + SN) 
and 2 m/s gusts recorded at CH2 and CH4 (correct 
channel) 

B8 Residuals and likelihood differences at FC5 with no 

failures. TS + SN, commands and gust inputs 

B9 Residuals and likelihood differences at FC8 with no 

failures. TS + SN, command and gust inputs. 
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Appendix B 


For simulated failures the excitation is labeled at the top of each figure. 

OK = Test signal and no failure simulated 

LG = Low gust level (rms 7=1 m/ sec) 

HG = High gust level (rms=2 m/sec) 

2 

LC = Small C ’I* command (3 m/sec ) 

2 

HC = Large C* command (10 m/sec ) 
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Figure B7 










TS + SN 



40,000 FT, M = 1.2 


2 M/S GUSTS 


C+ COMMAND 





